Details
-
Bug
-
Status: Resolved
-
Normal
-
Resolution: Fixed
-
None
-
None
-
Night's Watch
-
NW - 2020-09-01
-
Needs Assessment
-
Enhancement
-
Use ntdll.dll instead of ntoskrnl.exe to get. more accurately, the Windows Build number for the kernelrealese fact.
-
Needs Assessment
Description
Facter 3 load ntoskrnl.exe and calls RtlGetVersion to get the build number.
It seems like build 1909 of Windows has a bug that retrieves 18362 instead of 18363 as the build number.
Loading Ntdll.dll exposes the same method as ntoskrnl.exe and it seems to return the correct build number.
We need to update Facter 3 to use Ntdll.dll instead of ntoskrnl.exe
Ref: https://docs.microsoft.com/en-us/windows/win32/devnotes/rtlgetversion